Win32/RiskWare.RemoteAdmin.RemoteExec

[baran 0]

hi guys

how can i solve this problem?

[Marcos 5,466]

Do you experience any issues with cleaning the threat? Is it recurring?

[baran 0]

Yes, it is constantly detected and deleted on all systems on the network

Why do it again?

[Marcos 5,466]

Please provide logs collected with ESET Log Collector from such machine.

[baran 0]

what log? witch one? you need

• Default
• Threat Detection
• All:
• None
• Custom

[Marcos 5,466]

Default template is ok unless we explicitly ask to use a non-default one.

[baran 0]

 

here you are

thank you

efsw_logs.zip

[Marcos 5,466]

The malware is being copied to network shares from a remote machine with SR**********S\Administrator logged in.

Please carry on as follows:
- close any unnecessary network-aware applications that generate network traffic
- enable advanced network protection logging in the adv. setup -> tools -> diagnostics
- wait until the malware is detected
- disable logging
- collect fresh logs with ELC.

[baran 0]

thank you so much